Privacy Policy

This Privacy Policy explains how Wish Up (“Wish Up”, “we”, “us”) collects, uses, shares, and protects personal information when you use our websites, apps, and services (the “Service”). It applies to everyone who uses Wish Up, and to the limited information that appears in a child profile created by an adult account owner.

Wish Up is designed to be a low-data product. We collect only what we need to run a family motivation app, we do not sell personal information, and we do not show advertising to anyone — least of all children.

Because there is no child sign-up path, every piece of information relating to a child reaches us through the adult account owner who entered it. By adding a child profile, the adult confirms that they are that child's parent or legal guardian (or are authorised by them) and consents to our processing of that limited profile information for the purposes described in this policy.

What a child profile can contain

• A first name or nickname chosen by the parent.
• An age or age range, or a birth month/year, used to keep encouragement age-appropriate.
• An optional avatar chosen from our illustrated set, or an optional photo the parent uploads.
• Wishes, goals, Star totals, streaks and progress history within the family.
• Optional short notes a parent writes about a goal or a milestone.

What we never ask for about a child

• No child email address, phone number, or independent login credentials.
• No home address, precise location, or school records.
• No government identifiers, medical records, or health diagnoses.
• No behavioural advertising profiles, no ad identifiers, and no third-party ad tracking.
• No public profile, no social feed, no messaging with people outside the family.

We handle child profile information consistently with children's privacy laws such as the US Children's Online Privacy Protection Act (COPPA) and the UK Age Appropriate Design Code, on the basis of verifiable parental consent given by the account-owning adult. We do not condition a child's participation on disclosing more information than is reasonably necessary.

Information you give us

• Account information: the adult owner's name, email address, password (stored only as a salted hash), and confirmation that they are 18 or older.
• Family setup: family name, child profiles, Wishes, goals, Star rules, and any co-parent or guardian you invite.
• Billing information: plan, billing period, transaction history, and partial card details supplied by our payment processor. We never store full card numbers.
• Support and communications: messages you send us, and the contents of survey or feedback responses.

Information collected automatically

• Device and technical data: device type, operating system, browser, language, and app version.
• Usage data: pages or screens viewed, features used, timestamps, and error/diagnostic logs.
• Approximate location inferred from IP address, used for security, fraud prevention, and regional formatting — never precise GPS location.
• Cookies and similar technologies as described below.

Information from third parties

• Payment confirmation and subscription status from our payment processors and, for in-app purchases, from mobile app stores.
• Authentication confirmation if you choose to sign in with a third-party identity provider.
• Aggregated analytics from our hosting and analytics providers.

• To create and maintain your account, family, and child profiles, and to deliver core features such as Wishes, Stars, streaks, and progress.
• To generate age-appropriate Star Coach encouragement and suggestions.
• To process payments, manage subscriptions, and send billing notices and receipts.
• To provide customer support and respond to your requests.
• To secure the Service — detecting fraud, abuse, unauthorised access, and attempted under-18 registrations.
• To improve reliability and product quality using aggregated or de-identified usage data.
• To send service and transactional messages, and — only with the adult owner's consent where required — occasional product emails you can unsubscribe from at any time.
• To comply with legal obligations and enforce our Terms of Service.

Legal bases (UK/EU and similar regimes)

• Performance of a contract: providing the Service you signed up for.
• Legitimate interests: securing the Service, preventing abuse, and improving the product in ways that do not override your rights.
• Consent: optional marketing emails, optional photo uploads, and non-essential analytics where consent is required. Consent for child profile data is given by the parent or guardian.
• Legal obligation: tax, accounting, and lawful requests from authorities.

Star Coach uses automated systems, including third-party AI model providers, to produce encouragement, ideas, and summaries. When Star Coach runs, we send the minimum context needed — for example an age range, a goal description, and recent progress — rather than a full profile. We instruct our AI providers to process this data only to return a response to us, and we do not permit them to use it to train their own general-purpose models.

Star Coach output is motivational only and is not advice from a professional. We keep short-lived logs of AI requests to debug problems and prevent abuse, and we delete or de-identify them under the retention schedule below.

We share personal information only in these situations:

• Within your family: profiles, Wishes, and Star progress are visible to the adult account owner and to any adult they invite, and to child profiles on devices the adult has set up.
• Service providers (processors): hosting and database providers, email delivery, payment processing, error monitoring, analytics, and AI model providers. They act on our instructions under contract and may not use your data for their own purposes.
• Legal and safety: when required by law, valid legal process, or to protect the rights, safety, or property of a child, a user, the public, or Wish Up.
• Business transfers: if Wish Up is involved in a merger, acquisition, financing, or sale of assets, information may transfer to the successor, which must continue to honour this policy or give you notice and a choice.
• With your direction: when you ask us to connect or share with another service.

We never share child profile information with data brokers, advertisers, or ad networks.

We use strictly necessary cookies and local storage to keep you signed in, remember preferences, and protect the Service against abuse. We also use privacy-respecting analytics to understand aggregate usage — for example which pages are visited and where errors occur — and basic performance measurement.

• No third-party advertising cookies or ad-network pixels.
• No cross-site behavioural tracking of parents or children.
• Where the law requires consent for non-essential analytics, we ask for it and honour your choice.
• You can clear or block cookies in your browser settings; strictly necessary cookies are needed for sign-in to work.
• We honour Global Privacy Control (GPC) signals where applicable.

We keep personal information only as long as we need it for the purposes described here, then delete or de-identify it.

• Account and family data: kept while your account is active. After you delete your account, we remove it from active systems promptly and purge backups within 30 days, except where the law requires longer retention.
• Child profile data: deleted when the parent deletes the profile or the account, on the same schedule.
• Billing records: retained as long as tax and accounting law requires (typically up to 7 years).
• Security and diagnostic logs: typically 30–90 days.
• Support messages: typically up to 24 months.

• Encryption in transit (TLS) and encryption at rest for stored data.
• Passwords stored only as salted hashes — never in readable form.
• Row-level access controls so one family can never read another family's data.
• Least-privilege internal access, with staff access limited to what a task requires and logged.
• Regular dependency and security review of our infrastructure and code.

No system can be guaranteed perfectly secure. If a breach affects your personal information, we will notify you and any required regulator as the law requires. Please tell us immediately if you suspect unauthorised access to your account.

Depending on where you live, you may have some or all of the following rights. Parents may exercise these rights on behalf of their child profiles.

• Access: request a copy of the personal information we hold about you or your child profiles.
• Correction: ask us to fix inaccurate or incomplete information.
• Deletion: ask us to delete your account, a child profile, or specific information.
• Portability: receive your data in a portable, machine-readable format.
• Objection and restriction: object to or restrict certain processing based on legitimate interests.
• Withdraw consent: withdraw consent at any time where we rely on it, without affecting prior lawful processing.
• Opt out of marketing: unsubscribe from product emails using the link in any such email.
• Non-discrimination: we will not degrade your service because you exercised a privacy right.

To exercise a right, contact us through our support center. We may need to verify your identity and your relationship to the account before we act. We respond within the time the applicable law allows (generally 30 days, or 45 days for California requests, with extensions where permitted). You may also appeal a decision, or complain to your local data protection authority.

Wish Up is operated from the United States, and our providers may process data in the United States and other countries. When we transfer personal information out of the UK, EEA, or another region with transfer restrictions, we rely on appropriate safeguards such as Standard Contractual Clauses (with the UK Addendum where relevant) together with additional technical and organisational measures.

We may update this Privacy Policy to reflect changes to the Service, our providers, or the law. We will revise the “Last updated” date and, for material changes affecting how we use your or your child's information, notify you by email or in the app before the change takes effect where required.

For privacy questions, data requests, or to report a suspected under-18 account, reach us through our support center at app.wishupkids.com/help. We treat privacy requests as a priority and will always tell you what we did in response.